From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7A4314C10F4 for ; Sun, 18 Oct 2026 15:28:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337332; cv=none; b=WfH9oUQg1sYKholJb8pBEtF9f61QQCFO/Yw1nEJJhuOJnDjFlVsoD4sRB0S+T1Wp5wXb7IKFB2vGSeeg4uPRNTKUUyam+Z8GGCjjnWSpp1droz+cjoAfOk6ZhZ8lqmj9J3GnEJqb7FPLct0R45TGiCQbzoaZovqC5kuQARQtx6Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337332; c=relaxed/simple; bh=nq11V7woJgNhd9oKHOK9a+fwOXKzUvKzzW+wQM8fJAk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rXu/Kb1dox/FusUT6zzp7g8q5uqpfM/3uZ7vIZ0wlq/Rbg1MqD7bd2v7YPwestY3Bw2zb/5eU6l2kARUfGW35oszImd5RF5NZpNxcOTdCEWSDEutExFi/74gI9SZB8b+4E2V9YmPsdqz3VMB3TL1dbv0eKagGc7pxT9YKzkLRUs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=f0ai5hQA; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="f0ai5hQA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C1EC1F000C4; Sun, 18 Oct 2026 15:28:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337327; bh=4WZOaESr1p9KTnhsfmgLdes4y9PwCFikCAEkMeoGcsU=; h=From:To:Cc:Subject:Date:Reply-To; b=f0ai5hQAoJgX9PzUc/vJsYitk3B8QY5HW7z/+5HlLbPMoDVjxhFNC6Jmk3PHUUtwy MP4jYpsTyYmnZo8pOWRJotkXiq9byBe7l4ntaqplDUB8as4IPY0E/lPxFOkbOFn4+M SAExvUIz+b01Sm4W+LVYCEqP9SlCfnNC3ZKy7QvQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98558: net: flush skb_defer_nodes in dev_cpu_dead() Date: Sun, 18 Oct 2026 17:17:02 +0200 Message-ID: <2026101829-CVE-2026-98558-e662@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3090; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=yU8YDXmnLT7OhxV3k/8cONiDs/oMY3V4nn4As9G2MiI=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHk1s+i8a9ctlZ+3T/4drLVv9UrO7Xf5dcdZ8vy7i8 IyCm1t9OmJZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAih88zzM/77vrAubd03Uoh l4uXJf4VzJgSdIBhvkv5bKmvnJF8x3KeM6pJsG9wFnzMCQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net: flush skb_defer_nodes in dev_cpu_dead() When a CPU goes offline, dev_cpu_dead() drains its softnet queues (completion_queue, output_queue, poll_list, process_queue, and input_pkt_queue), but leaves net_hotdata.skb_defer_nodes untouched. If oldcpu goes offline while holding pending skbs in its skb_defer_nodes lists (e.g. below the sysctl_skb_defer_max >> 1 IPI threshold, or if the IPI races with CPU teardown), those skbs remain stranded until oldcpu is brought back online. If any of these skbs hold page_pool fragments, page_pool_destroy() will stall indefinitely waiting for inflight pages to be returned when a netdev or driver is torn down while oldcpu is offline. Additionally, if smp_call_function_single_async() fails in kick_defer_list_purge() because the target CPU went offline, reset defer_ipi_scheduled to 0 so future IPI kicks are not blocked when the CPU comes back online. Also, if oldcpu was the last online CPU on its NUMA node, drain that node's slot across all CPUs so no skbs deferred from that node remain stranded on idle remote CPUs (or if the node itself is subsequently offlined). Finally, in skb_attempt_defer_free(), re-check cpu_online(cpu) and whether the caller migrated CPUs after llist_add(), flushing the node list if so, to close the preemption TOCTOU race against CPU/node teardown. The Linux kernel CVE team has assigned CVE-2026-98558 to this issue. Affected and fixed versions =========================== Issue introduced in 5.19 with commit 68822bdf76f10c3dc80609d4e2cdc1e847429086 and fixed in 7.2.9 with commit c68f4157463448a76893223e117170be8374d773 Issue introduced in 5.19 with commit 68822bdf76f10c3dc80609d4e2cdc1e847429086 and fixed in 7.3-rc5 with commit 06e3f54e8b22040ada01a28343badf1990b4dd7d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98558 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/core/dev.c net/core/dev.h net/core/skbuff.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c68f4157463448a76893223e117170be8374d773 https://git.kernel.org/stable/c/06e3f54e8b22040ada01a28343badf1990b4dd7d